Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-123294 |
| Alert Source | GitHub Advisory - Critical Vulnerability |
| CVE Publication Year | 2026 |
| Date Published | 2026-11-06 |
| Vendor | JetBrains |
| Product | Hub, CLion, Datalore |
| CVSS Score | 9.6 (critical) |
| EPSS Score | No data |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
On November 6, 2026 JetBrains published its list of fixed security issues, in which four vulnerabilities were rated critical:
- CVE-2026-123294 (CVSS 9.6) — JetBrains Hub before 2026.2.52556: privilege escalation by changing email authentication details during the verification flow (CWE-915, HUB-13585). An attacker with a low-privileged account can obtain higher privileges in Hub — the authentication and user management service used by YouTrack and TeamCity, among others.
- CVE-2026-123832 (CVSS 9.6) — CLion before 2026.2: code execution in Safe Mode via a JSON compilation database (CWE-829, CPP-50449). The victim only needs to open a crafted project — despite Safe Mode, which is meant to block code execution from untrusted projects.
- CVE-2026-123831 (CVSS 9.6) — CLion before 2026.2 and 2026.1.4: code execution in Safe Mode via Meson project settings (CWE-829, CPP-50364). Same attack pattern — a malicious project opened by a developer.
- CVE-2026-123279 (CVSS 9.0) — Datalore before 2026.4: view-only collaborators could execute code in a notebook’s computation (CWE-863, DL-17211).
Required Actions
- JetBrains Hub (standalone installations): upgrade to version 2026.2.52556 or later.
- CLion: upgrade to version 2026.2; on the 2026.1 branch, 2026.1.4 fixes CVE-2026-123831, while for CVE-2026-123832 JetBrains lists only 2026.2. Until you upgrade, do not open projects from untrusted sources, even in Safe Mode.
- Datalore (On-Premises installations): upgrade to version 2026.4 or later. Until then, review who has view-only access to notebooks containing sensitive data and limit sharing to the minimum necessary.
After upgrading Hub, review accounts with administrative privileges and recent user email address changes for unauthorized modifications.
Who Is Affected?
The vulnerabilities affect Hub, CLion, Datalore by JetBrains:
- Hub — organizations running self-hosted YouTrack, TeamCity or standalone Hub as central sign-in for development team tools;
- CLion — C/C++ development teams (embedded software, industrial systems, games, system software);
- Datalore — data analytics and data science teams using shared notebooks, especially the On-Premises edition.
Check your software inventory and JetBrains Toolbox / company licenses to see which of these tools are used in your organization.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
